There has been a system that provides service to users via a network such as the Internet by running web application software and the like. This system is operated under appropriate management to provide stable services to the users. The operation and management of such systems involves, for example, measurement of system performance for the purpose of monitoring the system's response to user requests and detecting a possible delay. The performance measurement items may include, for example, processing time of each executed process, which begins with reception of a request and ends with transmission of a response to the requesting user. Another measurement item is processing time consumed for database access. In the case of multiple-layer systems such as a web three-layer system made up of web layer, application layer, and database layer, the above measurement may be achieved by using some existing techniques of transaction analysis. For example, one proposed technique collects messages from the network and investigates them to find out how transactions are processed in the system.
As mentioned above, the processing time of a transaction may be measured on the basis of messages produced during the transaction. This measurement begins with identifying such messages. Suppose, for example, that a transaction has invoked a process in an upper layer of a multiple-layer system. The execution period of this process is identified by finding a request message and a response message that relate to the process. When there is found a request message sent to a lower layer of the system during the execution period of the upper-layer process, the found request message is associated with the upper-layer request and response messages, because these messages are deemed to be relating to the same transaction.
The above method includes determination of whether a lower-layer request message has been transmitted within the execution period of an upper-layer process. This determination is made on the basis of time information indicating the occurrence of events such as transmission and reception of messages. For a correct determination, it is important that these events can be put into a time sequence with high accuracy.
In some cases, information about message transmissions and other events is collected at a plurality of different devices. The real-time clocks in these devices are supposed to be synchronized with each other for an enhanced accuracy in determining temporal relationships of events. For example, an existing technique makes a local time base synchronize with a central time base. See, for example, the following literature:
Japanese Laid-open Patent Publication No. 2006-011683
Japanese National Publication of International Patent Application No. 2002-510081
However, simply synchronizing real-time clocks may be insufficient in some cases such as when several message-capturing devices are used to collect information about events that occur in different servers. Even if the exact synchronism of real-time clocks is achieved among those capturing devices, the precise moment of time stamping may differ from device to device because the time-stamping process in one device is running independently of those in other devices. Such time differences in the time stamping may result in inconsistency of collected time information. This also happens in the case where several event-capturing processes in a single device are used to collect event information of different servers.
As can be seen from the above discussion, the time information contained in collected event records may have some inconsistencies, which spoil the accuracy of determination as to the relative order of observed events such as transmission and reception of messages. While these event records may be subjected to transaction analysis, the resulting output would be less confident because of the above reasons.
The conventional systems lack the capability of determining correction values for correcting time information of events that occurred in different servers. That is, they are unable to compensate for the possible time differences in event records of server processes which are collected by using several different capturing devices or processes.